| var graph_raw_data = [{"parent_id": 1796, "process_name": "65fg67n.exe", "process_id": 1592, "first_seen": "2016-02-16 17:41:35,173", "calls": [{"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,183", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:41:35,193", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,193", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,193", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,193", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,193", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,193", "api": "NtQueryInformationFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,193", "api": "LdrGetProcedureAddress"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,203", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,203", "api": "VirtualProtectEx"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,203", "api": "VirtualProtectEx"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,203", "api": "NtFreeVirtualMemory"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,203", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,213", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,213", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,213", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,213", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:41:35,223", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtOpenFile"}, {"category": "device", "timestamp": "2016-02-16 17:41:35,223", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:41:35,223", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtOpenFile"}, {"category": "device", "timestamp": "2016-02-16 17:41:35,223", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:41:35,223", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:35,223", "api": "DeviceIoControl"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "RegQueryValueExA"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,223", "api": "LdrGetDllHandle"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,223", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,223", "api": "NtQueryInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,223", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,223", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,233", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,233", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,233", "api": "NtReadFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,293", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,293", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,293", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,293", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtReadFile"}, {"category": "misc", "timestamp": "2016-02-16 17:41:35,303", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtSetInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtSetInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,303", "api": "RegCloseKey"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenMutant"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenMutant"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,303", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,303", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,303", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,303", "api": "ZwMapViewOfSection"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenMutant"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,313", "api": "ZwMapViewOfSection"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenMutant"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,313", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtQueryInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegEnumKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegEnumKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegEnumKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,313", "api": "NtQueryInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,313", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,323", "api": "NtOpenMutant"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,323", "api": "NtQueryInformationFile"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,323", "api": "NtOpenMutant"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,323", "api": "NtCreateMutant"}, {"category": "synchronization", "timestamp": "2016-02-16 17:41:35,323", "api": "NtOpenMutant"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetDllHandle"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,323", "api": "WSAStartup"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,323", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,323", "api": "NtQueryInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,323", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,333", "api": "NtQueryInformationFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,333", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "services", "timestamp": "2016-02-16 17:41:35,333", "api": "OpenSCManagerW"}, {"category": "services", "timestamp": "2016-02-16 17:41:35,333", "api": "OpenServiceW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,333", "api": "RegQueryValueExA"}, {"category": "services", "timestamp": "2016-02-16 17:41:35,333", "api": "OpenSCManagerA"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,343", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,343", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtQueryInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExA"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryInfoKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "NtQueryValueKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtReadFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:35,343", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtReadFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,343", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,343", "api": "NtReadFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,353", "api": "NtFreeVirtualMemory"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryInfoKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "NtQueryValueKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtReadFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "NtReadFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,353", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,353", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegEnumValueW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "process", "timestamp": "2016-02-16 17:41:35,363", "api": "NtFreeVirtualMemory"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,363", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegDeleteValueA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegDeleteValueA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegDeleteValueA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCreateKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,363", "api": "RegQueryValueExA"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,363", "api": "NtQueryInformationFile"}, {"category": "network", "timestamp": "2016-02-16 17:41:35,363", "api": "getaddrinfo"}, {"category": "network", "timestamp": "2016-02-16 17:41:35,363", "api": "getaddrinfo"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,363", "api": "socket"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,363", "api": "bind"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,363", "api": "NtDeviceIoControlFile"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,513", "api": "connect"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,513", "api": "setsockopt"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,513", "api": "setsockopt"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,513", "api": "setsockopt"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,513", "api": "send"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,683", "api": "WSARecv"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,683", "api": "ioctlsocket"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,683", "api": "WSARecv"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,683", "api": "ioctlsocket"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,683", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,683", "api": "RegSetValueExA"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,683", "api": "NtQueryInformationFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,683", "api": "RegQueryValueExA"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,683", "api": "NtQueryInformationFile"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,683", "api": "WSARecv"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,683", "api": "ioctlsocket"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,693", "api": "send"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,974", "api": "WSARecv"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,974", "api": "ioctlsocket"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,974", "api": "WSARecv"}, {"category": "socket", "timestamp": "2016-02-16 17:41:35,974", "api": "ioctlsocket"}, {"category": "registry", "timestamp": "2016-02-16 17:41:35,974", "api": "RegSetValueExA"}, {"category": "threading", "timestamp": "2016-02-16 17:41:35,974", "api": "CreateThread"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,984", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:35,994", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,004", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,014", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,024", "api": "NtQueryDirectoryFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:36,034", "api": "CreateProcessInternalW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,034", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,044", "api": "LdrLoadDll"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtOpenFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:36,044", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtQueryDirectoryFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,044", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,044", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,044", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtQueryDirectoryFile"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,044", "api": "OpenSCManagerW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,044", "api": "NtQueryDirectoryFile"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,054", "api": "OpenServiceW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtDeviceIoControlFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtDeviceIoControlFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtReadFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,054", "api": "LdrLoadDll"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "RegQueryInfoKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtReadFile"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,054", "api": "OpenSCManagerW"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,054", "api": "OpenServiceW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtQueryDirectoryFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,054", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,054", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,054", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,054", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,054", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,054", "api": "DeviceIoControl"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,054", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,054", "api": "NtDeviceIoControlFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtDeviceIoControlFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtReadFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,064", "api": "LdrLoadDll"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtReadFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,064", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,064", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtReadFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,064", "api": "LdrLoadDll"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,064", "api": "OpenSCManagerW"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,064", "api": "OpenServiceW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,064", "api": "LdrLoadDll"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,064", "api": "OpenSCManagerW"}, {"category": "services", "timestamp": "2016-02-16 17:41:36,064", "api": "OpenServiceW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,064", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,074", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,084", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,094", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,104", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,114", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,124", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,134", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,144", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,154", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,164", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,174", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,184", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,194", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,204", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,214", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,234", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,244", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,254", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,264", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,264", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,264", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,274", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,284", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,314", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,314", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,334", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,344", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,374", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,415", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,475", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,475", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,485", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,495", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,525", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,565", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,625", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,635", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,665", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,725", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,735", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,745", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,775", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,845", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,845", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,845", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,845", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,845", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,845", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,855", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,865", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,945", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,955", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,965", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,065", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,075", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,116", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,116", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,116", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,186", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,196", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,206", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,236", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,236", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,236", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,236", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,276", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,316", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,326", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,426", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,436", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,446", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,446", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,446", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,446", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,446", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,446", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,526", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:37,536", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,536", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,576", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,676", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,686", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,716", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,766", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,776", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,857", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,867", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,897", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,987", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:37,997", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,037", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,117", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,127", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,137", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,137", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,137", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,137", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,257", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,267", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,277", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,307", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,317", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,337", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,347", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,377", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,457", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,467", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,508", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,548", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,588", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,638", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,638", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,638", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,638", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,638", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,638", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,698", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,708", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,748", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,788", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,798", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,808", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,838", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,878", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,888", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,928", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,928", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,928", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,928", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,928", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:38,928", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,008", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,018", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,048", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,058", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,058", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,058", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,058", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,058", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,058", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,088", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,098", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,108", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,118", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,128", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,138", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,148", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,158", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,168", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,178", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,188", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,199", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,229", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,239", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,249", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,259", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,269", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,279", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,289", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,299", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,299", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,299", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,299", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,299", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,309", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,319", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,329", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,359", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,369", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,379", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,389", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,399", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,399", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,399", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,399", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,399", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,409", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,409", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,409", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,409", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,419", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,429", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,439", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,449", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,459", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,469", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,479", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,489", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtQueryDirectoryFile"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:41:39,499", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegQueryValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:41:39,499", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,499", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,499", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,509", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,509", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,519", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,529", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,529", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,529", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,539", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,539", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,549", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,549", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,559", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,559", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,569", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,569", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,569", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,579", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,589", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,589", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,589", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,599", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,599", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,609", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,609", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,609", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,619", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,619", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,629", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,629", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,639", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,649", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,659", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,659", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,659", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,659", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,659", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,669", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,669", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,679", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,679", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,679", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,679", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,689", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,689", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,689", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,699", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,699", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,709", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,719", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,719", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,729", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,729", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,729", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,729", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,729", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,739", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,739", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,749", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,749", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,759", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,759", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,769", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,779", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,779", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,789", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,789", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,789", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,789", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,789", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,799", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,799", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,799", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,799", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,799", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,809", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,809", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,819", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,819", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,829", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,829", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,839", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,839", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,849", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,849", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,849", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,849", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,859", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,859", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,859", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,859", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,859", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,869", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,869", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,879", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,879", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,879", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,879", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,879", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,879", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,879", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,910", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,910", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,920", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,920", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,930", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,930", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,940", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,950", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,960", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,960", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,960", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,960", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,960", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,970", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,970", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,970", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,970", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,980", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,980", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,980", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,980", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,980", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,990", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,990", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,990", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:39,990", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:39,990", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,000", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,000", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,000", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,000", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,010", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,010", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,010", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,010", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,010", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,010", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,010", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,020", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,020", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,020", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,020", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,020", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,030", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,030", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,040", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,040", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,050", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,050", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,060", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,060", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,070", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,070", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,070", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,070", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,070", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,080", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,090", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,090", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,100", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,100", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,110", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,120", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,120", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,120", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,120", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,120", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,130", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,130", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,130", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,130", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,130", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,140", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,140", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,150", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,150", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,150", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,150", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,160", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,160", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,170", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,170", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,180", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,180", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,190", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,190", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,190", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,190", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,190", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,200", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,200", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,200", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,200", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,210", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,210", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,210", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,210", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,220", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,220", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,220", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,220", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,220", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,220", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,220", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,230", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,230", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,230", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,230", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,230", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,240", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,240", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,250", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,260", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,260", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,270", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,270", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,270", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,280", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,280", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,290", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,300", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,300", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,300", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,300", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,310", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,310", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,320", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,320", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,330", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,330", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,330", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,340", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,340", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,340", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,340", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,350", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,350", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,370", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,370", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,380", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,380", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,390", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,400", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,400", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,410", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,410", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,420", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,420", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,430", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,430", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,430", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,440", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,450", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,450", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,450", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,460", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,460", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,470", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,480", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,480", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,480", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,490", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,490", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,500", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,500", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,510", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,510", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,510", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,520", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,520", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,530", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,530", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,540", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,540", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,550", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,550", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,550", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,560", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,560", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,570", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,570", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,580", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,580", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,591", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,591", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,591", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,601", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,601", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,611", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,611", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,621", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,621", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,621", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,621", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,631", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,631", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,641", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,641", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,651", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,651", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,661", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,661", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,661", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,671", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,671", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,681", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,681", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,691", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,691", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,701", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,701", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,711", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,711", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,711", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,721", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,721", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,721", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,731", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,731", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,741", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,741", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,751", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,751", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,751", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,751", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,761", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,761", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,761", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,761", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,771", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,771", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,781", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,791", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,791", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,801", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,801", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,801", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,811", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,811", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,821", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,831", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,831", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,831", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,841", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,841", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,851", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,851", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,851", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,861", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,861", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,861", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,861", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,871", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,871", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,881", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,881", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,891", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,891", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,901", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,901", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,911", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,911", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,921", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,921", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,931", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,941", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,941", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,941", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,951", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,951", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,961", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,961", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,971", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,971", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,971", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,971", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,981", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,981", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:40,991", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:40,991", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,001", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,001", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,061", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,061", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,071", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,071", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,081", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,081", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,091", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,091", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,101", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,101", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,111", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,111", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,121", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,131", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,141", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,151", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,151", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,151", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,151", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,151", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,161", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,161", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,171", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,171", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,171", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,171", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,171", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,171", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,171", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,181", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,181", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,181", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,181", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,181", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,191", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,201", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,201", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,211", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,211", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,221", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,221", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,221", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,231", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,241", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,241", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,241", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,241", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,241", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,241", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,251", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,251", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,251", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,251", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,251", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,251", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,261", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,261", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,271", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,271", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,271", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,271", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,271", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,271", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,282", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,292", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,292", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,302", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,302", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,312", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,312", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,312", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,312", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,322", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,322", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,322", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,332", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,332", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,342", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,342", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,352", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,352", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,352", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,362", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,402", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,402", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,402", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,402", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,402", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,412", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,412", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,412", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,422", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,422", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,422", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,422", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,422", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,432", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,432", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,442", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,442", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,442", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,442", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,442", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,452", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,452", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,452", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,452", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,452", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,462", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,462", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,462", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,462", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,472", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,472", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,472", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,482", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,482", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,492", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,492", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,502", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,512", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,512", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,522", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,522", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,522", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,532", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,532", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,542", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,552", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,552", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,552", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,562", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,562", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,572", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,582", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,582", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,592", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,592", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,602", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,612", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,612", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,622", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,622", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,632", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,632", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,632", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,642", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,642", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,652", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,652", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,662", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,662", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,672", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,672", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,672", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,682", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,682", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,692", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,692", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,702", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,712", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,712", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,722", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,722", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,722", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,732", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,732", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,742", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,742", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,742", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,742", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,742", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,752", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,752", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,762", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,762", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,772", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,772", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,782", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,782", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,792", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,792", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,802", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,802", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,812", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,812", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,822", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,822", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,832", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,832", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,842", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,842", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,852", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,852", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,862", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,862", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,862", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,872", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,872", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,882", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,882", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,892", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,892", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,902", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,902", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,912", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,912", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,912", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,922", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,922", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,932", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,932", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,942", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,942", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,952", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,952", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,952", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,952", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,952", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,952", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,952", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,962", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,962", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,972", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,972", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,972", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,983", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,983", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:41,993", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:41,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,003", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,003", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,013", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,013", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,013", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,023", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,023", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,023", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,023", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,033", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,033", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,033", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,043", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,043", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,053", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,053", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,053", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,063", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,063", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,073", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,073", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,083", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,093", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,093", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,093", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,093", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,093", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,093", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,093", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,093", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,093", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,093", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,093", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,093", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,103", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,103", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,113", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,113", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,143", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,143", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,143", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,143", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,143", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,153", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:42,153", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,153", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,153", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,163", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,163", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,173", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,173", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,183", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,183", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,193", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,203", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,213", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,213", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,223", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,223", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,223", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,233", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,233", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,243", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,243", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,243", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,253", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,253", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,253", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,253", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,253", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,263", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,263", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,273", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,273", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,273", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,283", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,283", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,293", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,303", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,313", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,313", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,313", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,313", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,323", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,333", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,333", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,343", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,343", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,353", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,353", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,363", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,363", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,373", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,373", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,383", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,383", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,383", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,393", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,393", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,413", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,413", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,413", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,423", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,423", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,433", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,433", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,443", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,443", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,443", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,453", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,453", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,463", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,463", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,473", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,483", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,483", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,483", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,483", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,483", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,483", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,493", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,493", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,503", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,503", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,503", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,513", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,513", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,523", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,523", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,533", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,533", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,533", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,543", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,543", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,553", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,553", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,563", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,563", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,573", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,573", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,583", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,583", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,583", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,583", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,583", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,583", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,583", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,593", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,593", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,593", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,593", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,593", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,593", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,593", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,603", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,603", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,613", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,613", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,623", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,623", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,633", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,643", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,643", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,643", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,643", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,643", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,643", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,643", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,653", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,653", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,663", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,663", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,674", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,674", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,684", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,684", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,694", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,694", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,694", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,694", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,694", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,704", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,704", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,714", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,714", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,724", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,724", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,724", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,724", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,724", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,734", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,734", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,744", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,744", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,744", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,744", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,754", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,764", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,764", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,764", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,774", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,774", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,784", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,784", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,784", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,794", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,794", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,794", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,804", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,804", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,814", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,814", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,824", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,824", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,824", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,834", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,844", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,844", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,844", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,854", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,864", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,864", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,864", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,874", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,884", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,884", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,894", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,894", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,894", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,904", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,914", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,924", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,924", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,934", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,934", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,934", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,944", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,944", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,954", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,954", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,954", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,964", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,964", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,974", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,974", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,984", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,984", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,994", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:42,994", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:42,994", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,004", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,004", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,014", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,014", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,024", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,024", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,034", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,034", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,044", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,054", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,054", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,054", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,064", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,064", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,074", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,084", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,084", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,084", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,094", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,094", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,104", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,104", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,114", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,124", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,124", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,124", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,134", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,134", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,144", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,144", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,154", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,154", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,154", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,154", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,154", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,174", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,174", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,184", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,184", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,184", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,194", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,194", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,204", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,204", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,214", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,224", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,234", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,244", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,254", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,254", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,264", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,264", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,264", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,274", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,274", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,284", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,284", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,294", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,294", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,304", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,304", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,304", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,304", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,314", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,314", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,324", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,324", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,324", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,334", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,334", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,344", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,344", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,354", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,354", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,354", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,365", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,365", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,375", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,375", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,375", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,385", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,395", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,395", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,395", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,405", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,405", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,425", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,425", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,425", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,425", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,425", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,435", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,435", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,445", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,455", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,455", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,465", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,465", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,475", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,475", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,475", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,485", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,485", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,495", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,505", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,505", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,505", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,515", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,515", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,525", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,525", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,525", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,525", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,525", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,535", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,535", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,535", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,535", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,535", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,545", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,555", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,555", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,555", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,565", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,575", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,575", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,575", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,575", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,585", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,585", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,595", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,595", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,595", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,605", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,605", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,615", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,615", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,625", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,625", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,625", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,625", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,635", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,635", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,635", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,635", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,635", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,645", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,645", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,655", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,655", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,665", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,665", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,665", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,675", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,675", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,685", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,685", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,695", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,695", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,695", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,705", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,705", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,715", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,715", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,725", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,725", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,735", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,735", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,745", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,755", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,765", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,775", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,775", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,785", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,785", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,795", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,795", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,795", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,805", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,805", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,815", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,815", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,815", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,825", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,825", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,825", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,825", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,825", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,835", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,845", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,855", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,865", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,865", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,865", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,865", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,865", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,875", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,875", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,875", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,875", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,875", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,885", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,885", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,895", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,905", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,905", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,905", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,905", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,915", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,915", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,925", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,935", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,945", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,945", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,955", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,955", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,955", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,965", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,975", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,975", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,985", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,985", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,985", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,985", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,985", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,985", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:43,995", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:43,995", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,005", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,005", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,005", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,015", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,015", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,025", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,025", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,025", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,035", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,035", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,045", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,045", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,055", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,055", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,066", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,076", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,086", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,096", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,106", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,106", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,106", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,106", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,106", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,106", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,116", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,116", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,116", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,116", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,126", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,126", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,136", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,136", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,136", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,146", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,146", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,146", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,146", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,156", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,166", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,166", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,176", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,176", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,186", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,186", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,196", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,196", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,206", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,216", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,226", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,226", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,236", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,236", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,246", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,246", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,246", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,256", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,266", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,266", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,266", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,276", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,276", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,276", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,286", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,286", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,286", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,286", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,296", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,296", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,296", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,296", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,296", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,306", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,316", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,316", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,316", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,316", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,326", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,326", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,336", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,336", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,346", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,346", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,356", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,356", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,366", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,366", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,366", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,376", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,376", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,386", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,386", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,396", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,396", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,406", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,406", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,406", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,416", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,416", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,426", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,436", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,446", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,446", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,446", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,456", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,456", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,466", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,466", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,476", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,476", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,486", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,486", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,486", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,496", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,496", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,506", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,516", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,526", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,526", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,526", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,526", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,526", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,536", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,536", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,536", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,536", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,536", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,546", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,546", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,556", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,556", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,556", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,556", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,556", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,566", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,566", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,566", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,576", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,576", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,586", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,586", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,586", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,596", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,596", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,596", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,596", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,596", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,606", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,616", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,616", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,616", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,616", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,616", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,616", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,616", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,616", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,616", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,616", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,626", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,626", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,626", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,626", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,626", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,626", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,626", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,636", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,636", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,646", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,646", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,656", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:44,656", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,666", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,666", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,676", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,676", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,676", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,686", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,686", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,696", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,696", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,706", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,706", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,716", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,716", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,716", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,716", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,726", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,726", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,726", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,726", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,726", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,726", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,726", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,736", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,736", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,746", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,746", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,757", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,757", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,767", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,767", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,777", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,777", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,797", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,797", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,797", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,807", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,807", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,817", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,817", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,827", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,827", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,827", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,837", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,847", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,847", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,857", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,857", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,857", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,867", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,867", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,877", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,877", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,887", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,887", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,887", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,897", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,897", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,907", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,907", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,917", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,927", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,937", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,937", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,937", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,947", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,947", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,957", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,967", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,967", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,967", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,977", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,987", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,987", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,997", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:44,997", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:44,997", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,007", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,007", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,017", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,017", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,027", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,027", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,037", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,037", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,037", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,047", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,047", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,057", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,057", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,067", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,077", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,077", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,077", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,087", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,087", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,097", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,097", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,107", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,107", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,117", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,117", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,117", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,127", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,127", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,137", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,147", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,147", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,147", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,157", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,167", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,167", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,167", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,177", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,177", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,187", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,197", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,197", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,197", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,207", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,207", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,217", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,227", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,227", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,237", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,237", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,237", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,247", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,247", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,257", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,257", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,257", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,267", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,267", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,277", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,277", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,287", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,287", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,287", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,287", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,287", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,297", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,297", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,297", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,317", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,317", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,327", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,327", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,337", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,347", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,347", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,347", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,357", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,357", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,367", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,377", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,377", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,387", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,387", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,387", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,397", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,397", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,407", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,407", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,417", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,417", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,427", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,427", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,427", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,437", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,437", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,437", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,458", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,458", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,468", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,468", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,468", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,478", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,478", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,488", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,488", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,498", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,508", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,508", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,518", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,518", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,528", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,528", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,538", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,538", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,548", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,548", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,548", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,558", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,558", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,568", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,568", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,578", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,578", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,588", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,588", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,588", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,588", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,588", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,588", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,588", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,608", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,608", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,608", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,608", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,618", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,618", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,618", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,618", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,618", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,618", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,618", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,628", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,628", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,638", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,638", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,638", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,648", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,648", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,658", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,668", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,678", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,678", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,688", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,688", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,698", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,698", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,708", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,708", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,718", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,718", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,728", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,728", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,728", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,728", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,728", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,738", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,738", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,738", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,738", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,738", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,748", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,748", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,748", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,748", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,748", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,758", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,758", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,758", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,758", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,758", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,758", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,768", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,768", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,768", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,768", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,768", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,778", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,778", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,778", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,778", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,778", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,778", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,778", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,788", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,788", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,798", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,798", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,808", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,808", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,818", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,818", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,828", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,828", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,828", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,828", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,838", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,838", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,838", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,838", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,848", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,858", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,858", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,858", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,858", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,868", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,868", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,868", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,878", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,878", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,878", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,878", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,878", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,888", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,888", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,888", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,888", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,888", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,898", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,898", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,898", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,898", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,898", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,908", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,908", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,908", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,908", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,918", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,918", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,918", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,918", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,928", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,928", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,928", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,928", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,938", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,948", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,948", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,948", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,948", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,948", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,948", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,958", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,958", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,958", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,958", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,968", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,968", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,978", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,978", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,978", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,978", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,978", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,988", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,988", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:45,998", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:45,998", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,008", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,008", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,018", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,018", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,028", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,028", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,038", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,038", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,048", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,048", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,058", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,058", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,068", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,068", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,068", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,068", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,068", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,068", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,068", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,078", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,078", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,088", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,088", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,088", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,088", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,088", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,088", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,088", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,098", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,098", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,098", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,098", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,098", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,098", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,108", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,108", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,108", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,118", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,118", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,128", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,128", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,138", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,138", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,169", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,169", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,169", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,169", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,179", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,179", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,189", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,189", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,199", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,199", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,209", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,209", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,219", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,219", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,229", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,229", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,229", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,239", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,239", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,249", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,259", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,259", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,259", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,269", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,289", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,289", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,289", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,299", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,299", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,319", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,319", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,329", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,329", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,329", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,329", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,329", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,329", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,339", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,339", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,349", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,359", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,359", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,369", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,369", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,369", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,389", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,389", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,389", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,389", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,389", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,399", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,399", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,399", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,409", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,409", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,419", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,429", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,429", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,439", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,439", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,439", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,459", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,459", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,459", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,459", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,469", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,469", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,479", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,479", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,479", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,489", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,489", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,499", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,499", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,509", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,509", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,519", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,519", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,529", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,529", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,539", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,539", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,539", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,549", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,549", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,559", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,559", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,569", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,579", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,579", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,589", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,589", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,599", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,609", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,609", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,609", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,609", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,609", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,619", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,619", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,629", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,639", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,649", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,649", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,649", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,649", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,649", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,659", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,659", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,659", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,659", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,669", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,669", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,679", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,689", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,699", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,699", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,699", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,709", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,709", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,719", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,719", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,729", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,729", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,739", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,739", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,749", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,749", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,749", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,759", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,759", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,769", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,769", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,779", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,789", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,789", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,789", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,799", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,799", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,809", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,809", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,819", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,819", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,829", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,829", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,839", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,839", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,850", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,850", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,850", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,860", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,860", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,870", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,870", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,880", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,880", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,890", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,890", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,900", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,900", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,900", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,910", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,910", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,920", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,920", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,920", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,930", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,930", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,930", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,940", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,940", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,950", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,960", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,960", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,970", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,970", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,980", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,980", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:46,990", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:46,990", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,000", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,000", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,010", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,010", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,020", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,020", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,030", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,030", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,060", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,070", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,080", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,080", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,080", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,090", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,090", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,100", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,100", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,110", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,120", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,120", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,130", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,130", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,130", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,140", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,140", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,150", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,150", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,160", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,160", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,160", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,160", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,160", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,170", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,170", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,170", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,180", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,180", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,190", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,190", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,190", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,200", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,200", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,200", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,210", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,210", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,210", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,210", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,210", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,210", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,210", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,220", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,220", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,220", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,230", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,240", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,240", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,250", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:47,250", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,250", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,250", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,260", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,260", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,260", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,260", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,260", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,270", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,270", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,280", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,280", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,290", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,290", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,290", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,290", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,290", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,300", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,300", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,310", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,310", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,310", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,320", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,320", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,330", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,330", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,340", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,350", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,360", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,370", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,380", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,380", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,390", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,390", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,390", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,400", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,400", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,410", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,410", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,410", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,420", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,420", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,420", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,420", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,430", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,430", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,440", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,440", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,440", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,450", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,450", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,460", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,460", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,460", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,470", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,470", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,480", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,480", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,490", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,490", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,500", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,500", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,510", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,510", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,520", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,520", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,520", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,520", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,520", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,520", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,520", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,530", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,530", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,541", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,541", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,551", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,551", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,561", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,561", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,571", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,571", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,571", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,571", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,571", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,571", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,571", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,581", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,581", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,591", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,591", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,601", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,601", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,611", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,611", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,621", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,631", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,631", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,641", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,641", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,641", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,651", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,651", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,661", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,671", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,671", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,681", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,681", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,681", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,691", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,691", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,701", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,711", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,711", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,721", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,721", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,731", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,731", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,731", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,741", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,741", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,751", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,751", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,761", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,761", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,761", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,771", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,771", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,781", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,781", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,791", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,801", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,801", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,811", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,811", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,811", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,821", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,821", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,831", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,831", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,841", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,851", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,851", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,851", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,861", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,861", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,871", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,871", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,871", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,881", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,881", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,881", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,891", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,901", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,911", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,921", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,921", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,921", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,931", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,931", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,941", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,941", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,951", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,961", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,961", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,971", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,971", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,971", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,981", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,981", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:47,991", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:47,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,001", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,001", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,001", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,011", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,011", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,021", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,021", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,031", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,031", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,041", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,051", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,051", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,061", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,061", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,071", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,071", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,081", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,081", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,091", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,091", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,101", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,101", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,111", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,121", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,131", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,131", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,141", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,141", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,141", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,151", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,151", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,161", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,161", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,171", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,171", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,181", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,181", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,191", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,191", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,201", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,201", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,201", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,211", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,211", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,221", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,221", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,231", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,231", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,242", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,242", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,252", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,262", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,262", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,272", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,282", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,282", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,292", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,292", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,292", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,302", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,302", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,312", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,312", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,322", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,322", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,332", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,332", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,342", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,342", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,342", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,342", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,342", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,352", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,362", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,382", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,382", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,392", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,392", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,402", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,402", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,412", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,412", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,422", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,422", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,432", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,432", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,442", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,442", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,442", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,442", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,452", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,452", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,462", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,462", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,482", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,482", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,482", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,492", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,502", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,512", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,512", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,512", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,512", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,512", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,522", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,522", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,522", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,522", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,522", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,522", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,522", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,532", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,542", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,542", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,552", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,552", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,552", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,562", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,562", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,572", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,572", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,582", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,592", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,592", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,592", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,602", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,602", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,612", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,612", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,622", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,632", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,632", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,642", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,642", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,642", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,652", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,652", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,662", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,662", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,672", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,682", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,692", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,692", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,702", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,702", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,702", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,712", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,712", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,722", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,722", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,732", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,732", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,742", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,752", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,752", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,762", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,762", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,762", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,772", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,772", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,782", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,792", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,792", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,802", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,802", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,812", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,812", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,812", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,822", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,832", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,832", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,842", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,842", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,852", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,862", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,862", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,872", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,872", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,872", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,882", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,882", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,892", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,892", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,902", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,902", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,912", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,912", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,922", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,922", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,933", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,933", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,933", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,943", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,943", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,953", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,953", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,963", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,963", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,973", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,973", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,973", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,983", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,983", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:48,993", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:48,993", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,003", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,003", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,003", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,013", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,023", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,023", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,033", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,033", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,033", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,043", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,053", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,063", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,073", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,073", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,083", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,083", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,083", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,093", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,093", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,103", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,103", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,113", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,123", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,133", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,133", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,143", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,143", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,143", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,153", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,163", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,163", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,163", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,173", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,173", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,183", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,193", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,193", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,193", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,203", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,203", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,213", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,213", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,213", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,223", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,223", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,223", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,223", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,233", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,233", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,243", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,243", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,243", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,253", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,253", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,263", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,273", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,283", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,283", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,293", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,293", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,303", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,303", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,313", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,313", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,323", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,333", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,343", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,343", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,343", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,343", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,353", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,353", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,363", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,363", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,373", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,383", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,393", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,393", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,403", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,403", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,413", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,413", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,413", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,423", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,423", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,433", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,433", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,433", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,433", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,443", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,443", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,453", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,453", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,463", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,463", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,463", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,463", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,463", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,473", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,473", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,493", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,493", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,493", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,503", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,503", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,503", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,503", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,503", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,513", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,513", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,513", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,513", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,513", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,523", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,523", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,533", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,533", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,543", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,543", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,553", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,563", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,563", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,573", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,573", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,583", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,583", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,583", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,593", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,593", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,593", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,593", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,593", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,613", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,613", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,624", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,624", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,634", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,634", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,634", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,634", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,644", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,644", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,644", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,644", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,644", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,654", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,654", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,664", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,664", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,674", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,674", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,684", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,684", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,694", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,694", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,694", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,694", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,694", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,704", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,704", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,704", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,704", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,714", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,714", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,714", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,724", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,724", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,724", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,734", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,734", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,744", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,744", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,744", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,744", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,744", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,754", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,754", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,754", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,754", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,754", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,754", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,754", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,764", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,764", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,764", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,764", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,764", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,764", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,764", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,764", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,774", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,774", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,774", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,774", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,774", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,784", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,794", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,794", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,794", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,794", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:49,794", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,804", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,804", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,814", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,824", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,824", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,824", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,834", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,834", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,844", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,844", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,854", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,854", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,864", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,864", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,864", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,874", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,884", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,884", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,894", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,894", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,904", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,904", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,914", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,914", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,924", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,934", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,944", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,964", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,964", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,964", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,964", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,964", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,974", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,984", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,994", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:49,994", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,994", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:49,994", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,004", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,014", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,014", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,024", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,024", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,034", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,034", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,044", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,044", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,044", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,054", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,054", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,064", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,074", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,074", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,084", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,084", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,084", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,094", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,094", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,094", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,104", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,104", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,114", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,114", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,114", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,124", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,124", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,134", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,134", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,144", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,154", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,164", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,174", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,174", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,184", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,184", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,194", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,204", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,204", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,214", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,214", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,214", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,224", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,224", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,234", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,234", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,244", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,254", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,254", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,264", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,264", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,274", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,274", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,274", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,284", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,284", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,294", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,294", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,294", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,304", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,304", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,314", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,335", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,335", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,345", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,345", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,355", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,355", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,365", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,375", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,375", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,375", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,385", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,385", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,395", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,395", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,405", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,405", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,415", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,415", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,425", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,425", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,425", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,435", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,435", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,445", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,445", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,455", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,455", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,465", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,465", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,475", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,475", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,475", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,485", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,485", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,505", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,505", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,505", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,505", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,515", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,515", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,515", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,525", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,525", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,535", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,535", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,545", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,545", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,545", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,545", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,545", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,555", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,565", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,565", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,575", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,575", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,575", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,585", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,585", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,595", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,595", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,595", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,605", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,605", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,615", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,615", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,615", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,625", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,625", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,635", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,635", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,635", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,645", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,645", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,645", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,655", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,655", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,665", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,665", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,665", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,675", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,675", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,675", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,675", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,675", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,675", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,675", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,685", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,685", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,695", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,705", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,705", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,705", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,715", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,715", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,725", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,735", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,735", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,735", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,735", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,735", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,745", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,745", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,755", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,755", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,755", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,765", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,765", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,775", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,775", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,785", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,785", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,795", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,795", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,795", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,805", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,805", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,805", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,815", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,815", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,825", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,825", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,825", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,835", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,835", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,835", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,845", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,845", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,855", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,855", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,855", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,865", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,875", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,875", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,875", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,885", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,885", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,895", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,895", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,895", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,905", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,905", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,905", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,915", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,915", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,925", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,925", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,925", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,935", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,935", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,935", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,945", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,945", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,955", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,955", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,965", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,965", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,965", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,975", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,975", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,985", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,985", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,985", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,995", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:50,995", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:50,995", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,005", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,005", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,016", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,016", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,026", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,026", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,026", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,036", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,036", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,046", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,046", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,046", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,056", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,056", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,066", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,066", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,066", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,076", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,076", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,086", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,086", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,086", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,096", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,096", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,106", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,106", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,106", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,116", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,116", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,116", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,126", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,126", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,136", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,136", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,136", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,146", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,146", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,146", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,156", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,166", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,166", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,166", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,176", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,186", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,186", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,186", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,186", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,186", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,196", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,196", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,206", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,216", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,216", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,226", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,226", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,226", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,236", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,246", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,246", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,246", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,256", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,256", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,266", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,266", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,276", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,276", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,276", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,286", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,286", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,296", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,296", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,306", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,306", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,306", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,336", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,336", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,346", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,346", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,346", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,356", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,366", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,366", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,366", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,376", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,376", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,386", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,386", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,396", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,396", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,396", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,406", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,406", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,416", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,416", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,426", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,426", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,426", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,436", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,446", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,446", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,446", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,456", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,456", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,466", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,466", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,466", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,476", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,476", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,486", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,496", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,496", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,496", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,516", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,516", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,516", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,516", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,526", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,526", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,536", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,536", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,536", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,546", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,556", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,556", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,556", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,566", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,566", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,576", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,576", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,576", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,586", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,586", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,596", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,596", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,596", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,606", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,606", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,616", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,616", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,626", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,626", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,636", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,636", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,646", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,646", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,646", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,656", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,656", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,656", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,666", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,666", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,676", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,676", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,676", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,696", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,696", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,706", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,706", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,706", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,717", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,717", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,727", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,727", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,737", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,737", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,737", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,747", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,747", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,757", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,767", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,767", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,767", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,777", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,787", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,787", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,787", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,797", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,807", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,807", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,807", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,817", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,817", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,837", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,847", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,847", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,857", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,867", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,867", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,867", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,877", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,877", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,877", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,887", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,887", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,897", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,897", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,897", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,907", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,907", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,907", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,907", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,907", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,907", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,907", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,907", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,917", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,927", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,927", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:51,927", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,927", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,937", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,937", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,947", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,947", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,957", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,957", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,957", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,967", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,977", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,987", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,987", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,987", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:51,997", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:51,997", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,007", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,007", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,007", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,017", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,017", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,027", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,027", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,027", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,037", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,037", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,047", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,047", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,047", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,057", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,057", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,067", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,067", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,077", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,077", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,077", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,087", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,097", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,097", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,097", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,107", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,107", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,117", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,117", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,127", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,127", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,127", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,137", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,147", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,147", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,147", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,157", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,157", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,157", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,167", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,167", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,177", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,177", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,187", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,187", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,187", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,197", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,197", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,207", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,217", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,217", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,217", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,227", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,227", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,237", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,237", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,237", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,247", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,247", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,257", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,257", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,257", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,267", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,267", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,277", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,277", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,287", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,287", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,287", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,297", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,297", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,297", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,307", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,307", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,327", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,327", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,337", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,337", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,337", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,347", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,347", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,357", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,357", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,357", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,367", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,367", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,377", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,377", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,377", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,387", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,387", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,397", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,397", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,397", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,397", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,397", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,418", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,418", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,418", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,428", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,428", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,438", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,438", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,448", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,448", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,448", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,458", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,458", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,458", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,468", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,468", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,478", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,478", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,488", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,488", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,498", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,498", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,508", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,508", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,528", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,528", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,528", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,528", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,538", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,538", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,538", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,548", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,548", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,558", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,558", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,568", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,568", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,578", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,578", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,588", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,588", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,588", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,598", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,598", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,608", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,608", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,608", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,618", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,618", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,628", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,628", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,638", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,638", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,638", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,648", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,648", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,658", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,658", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,658", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,668", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,668", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,668", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,678", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,678", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,688", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,688", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,698", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,698", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,708", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,708", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,708", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,718", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,718", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,728", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,738", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,738", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,738", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,748", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,748", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,748", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,748", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,748", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,748", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,748", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,758", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,768", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,768", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,768", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,778", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,778", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,788", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,798", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,798", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,798", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,808", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,808", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,818", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,818", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,818", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,828", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,828", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,828", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,838", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,838", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,848", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,848", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,848", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,858", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,858", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,858", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,868", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,868", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,868", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,878", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,878", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,888", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,888", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,888", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,898", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,898", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,908", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,908", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,918", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,918", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,918", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,928", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,928", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,928", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,938", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,948", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,948", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,948", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,958", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,958", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,968", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,968", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,968", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,978", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,978", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,978", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,988", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,988", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,998", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:52,998", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:52,998", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,008", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,008", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,008", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,018", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,028", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,028", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,028", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,038", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,038", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,038", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,048", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,048", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,058", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,058", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,058", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,068", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,068", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,068", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,068", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,068", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,068", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,078", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,078", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,088", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,088", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,098", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,098", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,109", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,109", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,109", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,119", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,119", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,119", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,129", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,139", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,139", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,149", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,149", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,149", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,159", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,159", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,159", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,169", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,179", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,179", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,179", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,189", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,189", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,199", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,199", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,209", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,209", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,209", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,219", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,219", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,219", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,229", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,239", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,239", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,239", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,249", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,249", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,259", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,259", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,269", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,269", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,269", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,279", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,279", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,279", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,289", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,289", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,289", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,299", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,299", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,299", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,309", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,319", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,319", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,319", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,319", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,319", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,329", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,329", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,329", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,329", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,339", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,339", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,339", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,349", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,349", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,359", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,369", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,369", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,369", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,379", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,379", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,389", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,389", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,399", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,399", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,409", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,409", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,409", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,419", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,419", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,429", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,429", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,439", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,439", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,449", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,449", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,459", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,459", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,469", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,469", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,469", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,479", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,479", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,489", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,489", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,489", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,499", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,499", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,509", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,509", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,509", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,519", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,519", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,529", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,539", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,539", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,539", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,539", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,549", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,549", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,559", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,559", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,559", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,569", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,569", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,579", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,579", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,579", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,589", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,589", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,589", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,599", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,599", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,609", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,609", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,609", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,619", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,619", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,629", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,629", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,629", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,639", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,649", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,649", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,649", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,659", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,659", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,669", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,669", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,679", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,689", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,689", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,699", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,709", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,709", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,709", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,719", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,719", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,729", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,729", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,729", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,739", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,739", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,739", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,749", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,759", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,759", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,759", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,759", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,759", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,769", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,769", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,779", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,779", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,779", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,789", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,789", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,800", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,800", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,810", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,810", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,820", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,820", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,830", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,830", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,840", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,840", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,840", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,840", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,840", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,840", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,840", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,850", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,850", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,860", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,860", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,870", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,870", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,870", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,870", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,880", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,880", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,890", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,890", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,890", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,890", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,890", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,890", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,890", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,890", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,890", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,890", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,890", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,890", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,890", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,900", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,900", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,910", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,910", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,920", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,920", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:53,930", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,930", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,930", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,940", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,950", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,950", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,950", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,960", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,960", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,970", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,970", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,980", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,980", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,980", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:53,990", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:53,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,000", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,000", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,000", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,060", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,060", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,070", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,070", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,070", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,070", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,070", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,080", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,080", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,090", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,090", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,100", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,100", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,110", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,110", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,110", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,120", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,120", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,130", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,130", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,140", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,140", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,140", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,150", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,150", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,160", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,160", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,170", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,170", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,180", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,180", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,190", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,200", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,200", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,210", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,210", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,210", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,220", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,220", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,230", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,230", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,240", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,240", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,250", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,250", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,260", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,260", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,270", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,270", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,280", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,280", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,290", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,300", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,300", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,310", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,310", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,320", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,330", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,330", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,330", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,340", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,350", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,360", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,370", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,370", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,380", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,380", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,380", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,390", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,390", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,400", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,400", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,410", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,410", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,420", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,420", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,430", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,430", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,440", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,440", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,440", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,450", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,450", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,460", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,460", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,470", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,470", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,480", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,480", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,480", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,490", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,490", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,501", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,501", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,511", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,511", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,521", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,521", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,521", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,531", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,531", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,551", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,551", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,551", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,561", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,561", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,571", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,571", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,581", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,581", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,591", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,591", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,601", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,601", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,611", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,611", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,621", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,621", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,621", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,631", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,631", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,641", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,641", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,651", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,651", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,661", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,661", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,671", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,671", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,671", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,681", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,681", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,691", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,701", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,701", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,711", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,711", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,711", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,721", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,721", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,731", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,731", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,741", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,741", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,741", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,751", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,751", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,761", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,761", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,771", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,771", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,781", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,781", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,791", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,801", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,811", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,811", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,811", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,821", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,821", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,831", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,831", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,841", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,841", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,851", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,851", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,861", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,861", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,871", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,871", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,871", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,881", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,881", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,891", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,891", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,901", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,901", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,911", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,911", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,921", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,921", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,921", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,931", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,931", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,931", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,941", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,941", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,951", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,951", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,951", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,961", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,971", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,971", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,971", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:54,981", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:54,981", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,001", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,001", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,001", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,001", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,001", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,011", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,011", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,011", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,021", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,021", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,031", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,031", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,041", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,041", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,051", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,061", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,061", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,061", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,071", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,081", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,081", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,081", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,091", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,091", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,101", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,101", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,111", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,111", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,111", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,121", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,121", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,131", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,131", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,131", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,141", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,141", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,141", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,151", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,151", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,161", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,161", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,161", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,171", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,171", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,181", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,181", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,192", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,192", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,202", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,202", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,212", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,212", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,212", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,212", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,212", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,212", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,222", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,222", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,222", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,232", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,232", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,242", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,242", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,252", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,252", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,262", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,262", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,272", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,282", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,282", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,282", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,292", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,292", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,302", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,302", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,312", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,312", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,312", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,322", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,332", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,332", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,332", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,342", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,342", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,352", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,352", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,352", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,362", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,362", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,372", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,372", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,372", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,382", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,382", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,392", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,392", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,392", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,402", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,402", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,412", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,412", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,412", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,422", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,422", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,432", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,432", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,432", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,442", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,442", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,452", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,452", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,452", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,462", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,472", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,472", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,472", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,482", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,482", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,492", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,492", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,492", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,502", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,502", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,512", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,512", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,522", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,522", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,532", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,532", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,532", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,532", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,532", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,542", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,542", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,562", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,572", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,572", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,582", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,582", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,582", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,592", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,592", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,602", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,602", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,602", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,612", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,612", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,622", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,622", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,622", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,632", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,632", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,642", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,642", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,642", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,652", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,652", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,662", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,662", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,662", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,672", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,672", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,672", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,682", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,682", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,692", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,692", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,702", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,702", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,712", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,712", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,722", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,722", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,722", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,732", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,732", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,742", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,742", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,742", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,752", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,752", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,762", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,762", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,762", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,772", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,772", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,782", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,782", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,782", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,792", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,802", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,802", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,802", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,812", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,812", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,822", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,822", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,822", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,832", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,832", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,832", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,842", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,842", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,852", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,852", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,852", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,862", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,862", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,872", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,872", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,872", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,883", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,883", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,893", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,893", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,893", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,903", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,903", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,903", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,983", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:55,993", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:55,993", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,003", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,003", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,013", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,013", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,023", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,023", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,023", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,033", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,033", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,043", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,043", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,043", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,053", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,053", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,063", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,063", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,063", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,073", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,073", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,083", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,083", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,083", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,093", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,093", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,103", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,103", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,103", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,113", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,113", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,113", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,113", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,123", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,133", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,143", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,143", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,143", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,153", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,163", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,173", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,173", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,173", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,183", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,183", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,193", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,193", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,193", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,203", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,213", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,213", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,223", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,223", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,223", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,223", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,223", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,233", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,233", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,233", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,233", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,233", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,233", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,243", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,243", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,253", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,253", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,253", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:56,263", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,263", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,263", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,273", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,273", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,283", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,283", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,283", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,293", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,303", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,303", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,303", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,313", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,313", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,323", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,323", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,323", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,333", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,333", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,333", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,343", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,343", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,353", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,353", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,363", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,363", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,363", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,373", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,373", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,383", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,383", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,393", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,393", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,403", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,403", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,413", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,413", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,413", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,423", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,423", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,433", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,443", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,443", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,443", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,453", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,453", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,463", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,463", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,473", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,473", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,473", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,483", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,483", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,493", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,493", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,493", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,503", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,503", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,513", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,513", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,523", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,523", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,533", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,533", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,543", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,543", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,543", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,553", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,553", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,563", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,563", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,563", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,573", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,573", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,573", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,573", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,573", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,584", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,584", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,594", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,594", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,594", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,604", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,604", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,614", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,614", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,624", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,624", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,634", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,634", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,634", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,644", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,644", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,654", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,654", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,654", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,664", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,664", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,674", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,674", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,674", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,684", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,684", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,684", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,694", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,694", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,694", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,704", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,704", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,714", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,714", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,724", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,724", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,734", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,734", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,734", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,744", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,744", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,754", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,754", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,764", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,764", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,764", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,774", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,774", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,784", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,784", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,794", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,794", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,804", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,804", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,814", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,814", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,814", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,824", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,824", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,834", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,834", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,844", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,854", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,854", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,864", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,864", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,864", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,874", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,884", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,884", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,894", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,904", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,904", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,914", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,924", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,924", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,924", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,934", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,944", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,944", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,944", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,954", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,954", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,964", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,964", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,964", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,974", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,974", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,984", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,984", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,984", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:56,994", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:56,994", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,004", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,004", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,014", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,014", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,024", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,024", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,034", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,034", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,044", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,054", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,054", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,064", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,064", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,074", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,074", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,084", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,094", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,094", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,104", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,104", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,114", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,114", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,124", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,124", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,134", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,134", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,144", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,144", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,154", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,154", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,164", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,174", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,174", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,184", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,184", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,184", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,194", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,194", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,204", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,204", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,204", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,214", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,214", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,224", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,224", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,224", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,234", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,234", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,244", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,244", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,244", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,254", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,254", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,264", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,264", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,264", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,275", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,275", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,285", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,285", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,295", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,295", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,295", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,305", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,305", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,345", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,345", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,345", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,345", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,345", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,355", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,355", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,355", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,365", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,365", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,375", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,375", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,375", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,385", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,385", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,395", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,395", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,405", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,405", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,405", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,415", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,415", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,425", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,425", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,435", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,435", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,435", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,445", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,445", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,455", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,455", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,465", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,465", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,465", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,475", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,475", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,485", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,485", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,495", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,495", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,495", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,505", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,505", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,515", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,515", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,525", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,525", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,525", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,535", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,535", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,545", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,545", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,545", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,555", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,555", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,565", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,565", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,565", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,585", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,585", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,585", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,585", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,595", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,595", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,595", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,605", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,605", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,615", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,615", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,615", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,625", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,625", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,635", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,635", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,645", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,645", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,655", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,655", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,665", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,665", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,675", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,675", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,685", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,685", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,695", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,695", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,705", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,705", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,705", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,715", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,715", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,725", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,725", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,735", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,735", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,745", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,745", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,755", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,755", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,765", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,765", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,765", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,775", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,775", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,785", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,785", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,795", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,795", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,795", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,805", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,805", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,815", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,825", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,825", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,825", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,835", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,835", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,845", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,845", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,845", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,855", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,855", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,865", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,865", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,875", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,885", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,885", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,885", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,895", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,895", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,905", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,905", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,915", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,925", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,925", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,925", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,935", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,935", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,945", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,945", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,955", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,955", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,965", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,965", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,965", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,976", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,976", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,986", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,986", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:57,996", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:57,996", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,006", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,006", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,016", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,016", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,016", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,016", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,016", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,016", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,026", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,026", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,026", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,026", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,026", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,026", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,036", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,036", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,046", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,046", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,056", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,056", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,066", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,066", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,076", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,076", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,086", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,086", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,096", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,096", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,106", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,116", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,126", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,136", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,146", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,146", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,146", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,156", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,166", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,166", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,176", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,176", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,186", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,186", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,196", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,196", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,206", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,206", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,216", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,216", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,216", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,226", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,226", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,236", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,236", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,246", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,256", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,256", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,256", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,266", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,266", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,276", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,286", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,286", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,286", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,296", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,296", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,306", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,306", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,306", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,316", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,316", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,316", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,326", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,336", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,336", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,346", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,346", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,356", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,356", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,356", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,366", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,366", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,376", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,376", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,386", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,386", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,386", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,386", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,386", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,386", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,396", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,396", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,396", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,396", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,406", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,406", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,406", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,406", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,406", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,416", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,416", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,426", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,426", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,426", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,436", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,436", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,446", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,446", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,456", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,466", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,476", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,476", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,486", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,486", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,486", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,486", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,496", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,496", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,506", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,506", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,516", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,516", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,516", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,516", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,516", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,516", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,516", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,516", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,526", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,526", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,536", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,546", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:41:58,546", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,546", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,546", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,556", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,556", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,566", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,566", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,576", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,576", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,586", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,586", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,596", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,596", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,596", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,606", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,606", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,616", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,616", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,626", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,626", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,636", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,636", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,646", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,646", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,656", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,656", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,667", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,667", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,677", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,677", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,687", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,687", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,697", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,697", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,707", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,707", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,707", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,707", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,707", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,707", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,707", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,727", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,727", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,727", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,727", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,737", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,747", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,747", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,747", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,747", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,747", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,757", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,757", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,767", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,767", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,767", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,767", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,767", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,777", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,777", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,787", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,787", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,787", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,787", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,787", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,787", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,797", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,797", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,797", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,797", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,797", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,807", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,807", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,807", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,807", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,817", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,817", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,827", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,827", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,837", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,837", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,847", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,847", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,857", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,867", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,867", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,867", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,877", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,877", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,887", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,887", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,897", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,897", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,907", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,927", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,927", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,937", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,937", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,947", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,947", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,957", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,957", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,967", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,967", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,977", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,977", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,987", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,987", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:58,997", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:58,997", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,007", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,007", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,017", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,017", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,027", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,027", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,037", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,037", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,047", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,047", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,057", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,057", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,067", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,067", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,077", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,077", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,087", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,087", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,087", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,087", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,087", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,087", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,097", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,097", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,107", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,117", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,127", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,137", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,147", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,147", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,157", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,157", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,167", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,167", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,167", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,177", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,177", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,187", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,187", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,197", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,197", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,207", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,207", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,217", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,217", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,297", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,297", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,307", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,307", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,307", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,317", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,327", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,327", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,327", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,337", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,337", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,347", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,347", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,357", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,357", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,368", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,368", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,368", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,368", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,368", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,378", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,378", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,388", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,388", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,398", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,398", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,408", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,408", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,418", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,418", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,418", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,418", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,418", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,428", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,428", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,438", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,438", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,448", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,448", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,448", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,448", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,448", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,448", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,458", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,458", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,468", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,468", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,468", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,468", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,478", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,478", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,488", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,488", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,498", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,498", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,508", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,508", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,518", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,518", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,528", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,528", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,538", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,538", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,548", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,548", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,558", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,558", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,568", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,568", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,588", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,588", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,588", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,598", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,598", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,608", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,618", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,618", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,618", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,618", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,628", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,628", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,628", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,638", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,648", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,648", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,648", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,658", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,668", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,668", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,678", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,678", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,688", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,688", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,688", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,698", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,698", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,708", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,708", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,718", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,728", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,728", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,728", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,738", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,738", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,738", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,748", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,748", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,758", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,758", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,768", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,768", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,768", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,778", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,778", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,788", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,788", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,788", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,798", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,798", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,808", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,808", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,818", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,818", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,828", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,838", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,838", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,848", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,858", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,858", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,868", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,878", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,878", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,888", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,888", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,888", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,898", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,898", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,908", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,908", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,918", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,918", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,928", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,928", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,968", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,968", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,978", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,988", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,988", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,998", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:41:59,998", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:59,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,008", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,008", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,018", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,018", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,028", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,028", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,038", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,038", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,048", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,048", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,059", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,059", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,059", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,069", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,069", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,079", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,079", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,089", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,089", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,099", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,099", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,109", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,109", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,119", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,119", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,119", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,129", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,129", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,139", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,139", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,149", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,149", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,159", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,159", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,169", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,169", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,169", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,179", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,179", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,189", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,189", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,199", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,199", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,209", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,209", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,219", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,219", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,229", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,229", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,239", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,239", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,249", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,249", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,249", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,249", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,249", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,259", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,259", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,259", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,269", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,269", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,269", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,269", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,269", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,279", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,279", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,289", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,289", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,299", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,299", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,299", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,299", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,299", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,309", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,309", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,309", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,309", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,319", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,319", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,319", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,319", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,319", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,319", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,319", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,339", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,339", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,339", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,339", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,339", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,349", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,349", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,349", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,349", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,349", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,359", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,359", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,359", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,359", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,359", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,369", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,369", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,369", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,369", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,369", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,379", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,379", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,389", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,389", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,389", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,389", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,389", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,389", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,389", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,399", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,399", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,399", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,399", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,399", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,409", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,409", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,409", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,409", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,409", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,409", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,409", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,419", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,419", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,419", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,419", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,419", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,419", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,419", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,429", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,429", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,439", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,439", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,449", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,449", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,459", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,459", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,469", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,469", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,479", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,479", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,489", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,489", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,489", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,489", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,489", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,499", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,499", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,509", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,509", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,519", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,519", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,529", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,529", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,539", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,539", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,549", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,549", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,559", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,559", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,569", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,569", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,579", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,579", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,589", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,589", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,599", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,599", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,609", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,609", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,609", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,609", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,609", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,629", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,629", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,629", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,629", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,629", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,629", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,639", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,639", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,649", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,649", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,659", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,659", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,669", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,669", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,669", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,679", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,679", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,689", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,689", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,689", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,699", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,699", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,709", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,709", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,719", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,719", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,719", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,729", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,729", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,739", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,739", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,749", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,749", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,760", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,760", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,770", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,770", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,770", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,770", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,770", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,770", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,770", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,780", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,780", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,780", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,780", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,780", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,780", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,790", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,790", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,790", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,800", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,800", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,810", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,810", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,810", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,810", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,810", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,820", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,820", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,820", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,830", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,830", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,840", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,840", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,850", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,850", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,850", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,920", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,920", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,930", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,930", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,940", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,940", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,950", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,950", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,960", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,960", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,970", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,970", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,980", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,980", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:00,990", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:00,990", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,000", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,000", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,000", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,010", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,010", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,020", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,020", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,030", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,030", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,040", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,040", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,050", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,050", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,050", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,060", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,060", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,070", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,070", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,080", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,080", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,090", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,090", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,090", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,100", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,100", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,110", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,110", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,120", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,120", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,130", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,130", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,140", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,140", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,150", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,150", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,190", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,190", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,200", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,210", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,210", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,220", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,230", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,230", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,240", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,240", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,240", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,240", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,250", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,250", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,250", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,250", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,260", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,260", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,270", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,270", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,270", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,270", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,270", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,270", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,280", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,280", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,280", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,280", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,280", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,290", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,290", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,290", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,290", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,290", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,290", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,300", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,300", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,300", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,300", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,300", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,310", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,320", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,320", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,320", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,320", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,320", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,340", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,340", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,340", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,340", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,350", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,350", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,350", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,350", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,350", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,360", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,360", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,370", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,370", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,380", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,380", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,390", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,390", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,400", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,410", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,410", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,420", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,420", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,420", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,420", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,420", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,420", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,430", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,430", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,430", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,430", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,430", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,440", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,440", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,451", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,451", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,461", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,461", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,461", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,461", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,461", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,461", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,461", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,471", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,481", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,481", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,481", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,481", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,481", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,481", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,481", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,491", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,491", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,491", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,491", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,491", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,491", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,491", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,501", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,501", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,501", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,501", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,501", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,511", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,511", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,511", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,511", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,511", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,521", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,521", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,531", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,531", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,531", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,531", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,531", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,531", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,531", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,541", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,541", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,541", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,541", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,541", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,551", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,551", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,551", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,551", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,551", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,561", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,561", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,561", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,561", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,561", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,561", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,561", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,571", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,571", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,571", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,571", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,571", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,571", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,581", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,581", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,581", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,581", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,591", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,591", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,591", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,591", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,591", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,591", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,591", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,601", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,601", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,611", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,611", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,621", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,621", "api": "NtWriteFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:01,631", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,631", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,641", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,651", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,651", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,661", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,661", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,661", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,661", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,671", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,671", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,671", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,671", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,671", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,671", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,681", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,681", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,681", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,681", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,681", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,681", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,691", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,691", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,701", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,701", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,701", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,701", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,711", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,711", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,711", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,711", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,711", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,721", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,721", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,721", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,721", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,731", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,731", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,731", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,741", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,741", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,741", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,741", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,741", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,741", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,751", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,751", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,761", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,761", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,761", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,761", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,761", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,771", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,771", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,771", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,781", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,781", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,791", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,791", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,801", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,801", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,811", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,811", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,811", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,811", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,811", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,811", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,821", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,821", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,821", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,821", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,831", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,831", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,831", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,831", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,831", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,841", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,841", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,851", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,851", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,861", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,861", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,871", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,871", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,871", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,871", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,871", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,871", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,881", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,881", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,881", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,881", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,881", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,891", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,891", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,891", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,891", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,901", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,901", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,901", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,901", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,901", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,901", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,911", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,911", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,911", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,911", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,911", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,911", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,921", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,921", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,921", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,921", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,921", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,921", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,931", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,931", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,931", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,931", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,931", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,941", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,941", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,951", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,951", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,951", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,951", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,951", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,951", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,961", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,961", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,961", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,961", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,961", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,971", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,971", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,981", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,981", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:01,991", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:01,991", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,001", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,001", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,011", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,011", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,021", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,021", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,031", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,031", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,031", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,031", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,031", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,041", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,041", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,051", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,051", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,051", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,051", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,061", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,061", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,061", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,061", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,061", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,071", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,071", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,071", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,071", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,101", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,101", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,101", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,101", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,111", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,111", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,111", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,111", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,121", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,121", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,121", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,131", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,131", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,142", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,142", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,152", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,152", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,162", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,162", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,172", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,172", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,182", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,182", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,192", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,192", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,202", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,202", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,212", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,212", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,222", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,222", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,232", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,232", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,232", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,232", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,232", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,242", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,242", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,252", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,252", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,252", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,252", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,252", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,262", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,262", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,262", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,262", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,262", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,272", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,272", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,272", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,272", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,272", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,282", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,282", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,282", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,282", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,282", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,282", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,292", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,292", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,292", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,292", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,292", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,302", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,302", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,302", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,302", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,302", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,302", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,302", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,312", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,322", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,322", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,332", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,332", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,342", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,342", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,352", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,352", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,352", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,352", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,352", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,352", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,362", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,362", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,362", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,362", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,362", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,362", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,372", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,372", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,372", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,372", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,372", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,372", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,382", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,382", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,382", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,382", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,392", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,392", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,392", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,392", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,392", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,402", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,402", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,412", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,412", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,412", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,412", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,412", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,422", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,422", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,422", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,432", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,432", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,442", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,442", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,442", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,442", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,442", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,442", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,452", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,452", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,452", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,452", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,452", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,452", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,462", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,462", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,462", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,462", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,462", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,472", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,472", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,472", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,472", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,482", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,482", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,492", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,492", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,492", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,492", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,492", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,492", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,502", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,502", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,502", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,502", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,502", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,502", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,512", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,512", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,512", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,512", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,512", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,522", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,522", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,522", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,522", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,532", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,532", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,542", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,542", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,542", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,542", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,542", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,542", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,552", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,552", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,552", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,552", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,552", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,552", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,562", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,562", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,562", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,562", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,562", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,572", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,572", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,572", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,572", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,572", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,582", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,582", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,592", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,592", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,592", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,592", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,592", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,592", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,602", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,602", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,602", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,602", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,602", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,612", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,612", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,612", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,622", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,622", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,632", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,632", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,632", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,632", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,632", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,632", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,652", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,662", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,662", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,662", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,662", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,662", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,662", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,672", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,672", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,672", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,672", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,672", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,682", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,682", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,682", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,682", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,682", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,682", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,692", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,692", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,692", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,692", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,692", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,702", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,702", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,702", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,702", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,702", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,702", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,712", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,712", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,722", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,722", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,722", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,722", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,722", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,732", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,732", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,732", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,732", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,732", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,742", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,742", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,742", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,742", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,742", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,752", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,752", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,752", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,752", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,752", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,752", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,762", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,762", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,762", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,762", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,772", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,772", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,772", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,772", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,782", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,782", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,782", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,782", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,782", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,782", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,792", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,792", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,792", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,792", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,792", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,802", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,802", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,802", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,812", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,812", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,822", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,822", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,822", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,822", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,832", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,832", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,832", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,832", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,832", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,832", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,843", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,843", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,853", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,853", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,853", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,853", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,853", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,853", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,853", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,863", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,863", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,863", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,863", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,863", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,863", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,873", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,873", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,883", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,883", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,893", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,893", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,903", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,903", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,913", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,913", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,923", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,923", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,923", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,923", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,923", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,923", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,923", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,933", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,933", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,943", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,943", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,953", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,953", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,963", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,963", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,973", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,973", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,983", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,983", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,983", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,983", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,983", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,983", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,983", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:02,993", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:02,993", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,003", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,003", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,003", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,003", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,003", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,003", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,013", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,013", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,023", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,033", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,033", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,033", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,033", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,043", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,043", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,043", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,043", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,043", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,043", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,053", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,053", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,063", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,063", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,073", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,073", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,083", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,083", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,093", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,093", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,103", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,103", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,113", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,113", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,123", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,123", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,133", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,133", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,143", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,143", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,153", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,153", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,163", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,163", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,173", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,173", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,183", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,183", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,183", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,193", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,203", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,203", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,203", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,203", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,203", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,203", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,213", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,213", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,223", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,223", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,233", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,233", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,243", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,243", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,253", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,253", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,253", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,253", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,253", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,263", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,263", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,273", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,273", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,283", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,283", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,283", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,283", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,283", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,283", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,293", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,293", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,293", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,293", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,293", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,293", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,293", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,303", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,303", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,313", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,313", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,323", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,323", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,323", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,323", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,323", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,323", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,323", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,333", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,333", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,333", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,333", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,343", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,343", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,353", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,353", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,363", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,363", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,363", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,363", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,363", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,363", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,373", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,373", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,383", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,383", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,383", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,383", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,383", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,383", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,393", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,403", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,403", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,403", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,403", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,403", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,403", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,413", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,413", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,413", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,413", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,413", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,413", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,423", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,423", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,423", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,423", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,423", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,423", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,433", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,433", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,443", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,443", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,453", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,453", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,493", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,503", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,503", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,503", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,503", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,503", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,503", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,513", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,513", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,523", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,523", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,534", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,534", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,544", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,544", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,554", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,554", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,564", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,564", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,574", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,574", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,584", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,584", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,594", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,604", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,604", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,604", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,604", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,604", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,604", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,614", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,614", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,624", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,624", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,634", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,634", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,634", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,634", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,644", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,644", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,654", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,654", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,654", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,664", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,664", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,674", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,674", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,674", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,674", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,674", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,674", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,684", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,684", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,694", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,694", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,704", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,704", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,714", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,714", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,714", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,714", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,714", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,724", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,724", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,734", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,734", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,744", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,744", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,754", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,754", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,764", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,764", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,764", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,764", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,764", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,764", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,774", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,774", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,774", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,774", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,774", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,784", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,784", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,784", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,784", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,784", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,784", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,794", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,794", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,804", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,804", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,804", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,804", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,814", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,824", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,824", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,824", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,824", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,824", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,834", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,834", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,834", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,834", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,834", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,834", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,844", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,844", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,854", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,854", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,854", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,854", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,854", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,864", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,864", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,864", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,874", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,874", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,884", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,884", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,894", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,894", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,894", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,894", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,894", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,894", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,904", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,904", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,914", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,914", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,924", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,924", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,924", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,924", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,924", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,934", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,944", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,944", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,944", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,944", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,944", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,954", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,954", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,964", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,964", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,964", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,964", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:03,974", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,974", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,974", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,974", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,984", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,984", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,984", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,994", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,994", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,994", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:03,994", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,004", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,004", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,004", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,004", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,014", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,014", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,024", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,024", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,034", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,034", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,034", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,034", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,034", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,034", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,044", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,044", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,044", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,044", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,044", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,044", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,054", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,064", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,064", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,064", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,064", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,074", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,074", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,074", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,074", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,074", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,074", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,084", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,084", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,094", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,094", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,104", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,104", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,104", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,104", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,114", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,114", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,114", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,124", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,124", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,134", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,144", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,144", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,154", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,154", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,164", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,164", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,174", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,184", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,184", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,194", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,194", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,194", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,194", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,204", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,204", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,214", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,214", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,224", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,224", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,235", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,235", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,245", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,245", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,255", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,255", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,255", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,255", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,255", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,265", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,265", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,265", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,265", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,265", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,265", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,265", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,275", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,275", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,285", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,285", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,295", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,295", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,305", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,305", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,315", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,315", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,325", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,325", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,345", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,345", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,345", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,345", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,345", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,345", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,355", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,355", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,365", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,375", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,375", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,385", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,385", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,395", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,395", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,405", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,405", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,805", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,805", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,815", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,815", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,825", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,825", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,835", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,835", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,835", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,835", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,845", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,845", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,855", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,855", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,865", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,865", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,875", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,875", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,875", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,875", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,875", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,875", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,885", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,885", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,885", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,885", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,885", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,885", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,885", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,895", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,895", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,905", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,905", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,915", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,915", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,915", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,915", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,915", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,926", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,926", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,936", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,936", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,936", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,936", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,936", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,936", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,936", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,946", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,946", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,946", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,946", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,946", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,946", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,956", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,956", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,956", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,956", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,956", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,956", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,956", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,966", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,966", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,966", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,966", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,966", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,966", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,966", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,976", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,976", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,976", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,976", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,976", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,986", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,986", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:04,996", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:04,996", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,006", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,006", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,016", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,016", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,016", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,016", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,016", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,026", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,026", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,026", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,036", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,036", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,036", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,036", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,036", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,046", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,046", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,046", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,046", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,046", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,056", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,056", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,056", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,056", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,056", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,066", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,066", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,066", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,066", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,066", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,076", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,076", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,086", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,086", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,086", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,086", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,086", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,096", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,106", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,106", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,106", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,106", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,106", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,106", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,116", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,116", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,126", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,126", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,136", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,136", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,136", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,136", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,136", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,146", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,146", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,156", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,156", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,166", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,166", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,176", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,176", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,186", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,186", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,196", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,196", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,206", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,206", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,216", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,216", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,216", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,216", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,216", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,216", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,226", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,226", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,236", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,236", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,236", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,236", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,236", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,236", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,246", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,246", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,256", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,256", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,256", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,256", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,256", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,256", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,266", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,266", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,276", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,276", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,286", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,286", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,296", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,296", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,306", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,306", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,316", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,316", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,326", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,326", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,346", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,346", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,356", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,356", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,356", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,356", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,386", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,386", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,386", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,386", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,386", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,386", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,396", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,396", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,406", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,406", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,416", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,416", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,426", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,426", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,426", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,426", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,426", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,426", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,426", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,436", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtWriteFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,436", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,436", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,446", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,446", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,456", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,456", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,466", "api": "NtFreeVirtualMemory"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,466", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,466", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,466", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,466", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,466", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,466", "api": "MoveFileWithProgressW"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,476", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,496", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,496", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,506", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,506", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,516", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,516", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,516", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,516", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,516", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,516", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,526", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,526", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,536", "api": "NtWriteFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:05,536", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,536", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,536", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,536", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,536", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,536", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,546", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,546", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,546", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,546", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,546", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,546", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,546", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,556", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,556", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,556", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,556", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,556", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,556", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,566", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,566", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,576", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,576", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,586", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,586", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,596", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,596", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,606", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,606", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,616", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,616", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,616", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,616", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,616", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,616", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,627", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,627", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,627", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,627", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,627", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,627", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,637", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,637", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,647", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,647", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,657", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,657", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,657", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,667", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,667", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,667", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,667", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,667", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,667", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,687", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,697", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,697", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,707", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,707", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,717", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,717", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,727", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,727", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,737", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,737", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,747", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,747", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,757", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,757", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,767", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,767", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,767", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,767", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,767", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,767", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,777", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,777", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,777", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,777", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,787", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,787", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,787", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,787", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,787", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,797", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,797", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,807", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,807", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,817", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,817", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,817", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,827", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,827", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,827", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,827", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,827", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,827", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,827", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,837", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,837", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,837", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,837", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,837", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,847", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,847", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,857", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,857", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,867", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,867", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,877", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,877", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,887", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,887", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,887", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,887", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,897", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,897", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,897", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,897", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,897", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,897", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,897", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,907", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,907", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,907", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,907", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,907", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,907", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,917", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,917", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,927", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,927", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,927", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,927", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,927", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,927", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,937", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,937", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,937", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,937", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,937", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,947", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,947", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,947", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,947", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,947", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,947", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,957", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,957", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,957", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,957", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,957", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,957", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,957", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,967", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,967", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,977", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,977", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,987", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,987", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:05,997", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:05,997", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,007", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,007", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,007", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,007", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,007", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,017", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,017", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,027", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,027", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,037", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,037", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,037", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,037", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,037", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,037", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,047", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,047", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,057", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,057", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,067", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,067", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,077", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,077", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,077", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,077", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,087", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,087", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,087", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,087", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,087", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,097", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,097", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,097", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,097", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,097", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,107", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,107", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,107", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,107", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,117", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,117", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,117", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,117", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,117", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,117", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,127", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,127", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,137", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,137", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,147", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,147", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,157", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,157", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,167", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,167", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,177", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,177", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,177", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,177", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,187", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,187", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,197", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,197", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,197", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,197", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,197", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,197", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,207", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,207", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,217", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,217", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,217", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,217", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,247", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,247", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,247", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,247", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,257", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,257", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,257", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,257", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,257", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,257", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,267", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,267", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,267", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,267", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,277", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,277", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,277", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,277", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,277", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,287", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,287", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,297", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,297", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,307", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,307", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,318", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,328", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,328", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,338", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,348", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,348", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,358", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,358", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,368", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,368", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,378", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,378", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,378", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,388", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,388", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,388", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,398", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,398", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,398", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,408", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,408", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,408", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,418", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,418", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,418", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,428", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,428", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,428", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,428", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,438", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,438", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,438", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,438", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,448", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,458", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,458", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,468", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,478", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,478", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,478", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,488", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,488", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,488", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,498", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,498", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,498", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,508", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,508", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,508", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,518", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,518", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,518", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,518", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,528", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,538", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,538", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,538", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,548", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,548", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,548", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,558", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,558", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,558", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,558", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,558", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,558", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,568", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,578", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,578", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,588", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,598", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,598", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,598", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,608", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,608", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,608", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,618", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,618", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,628", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,628", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,638", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,638", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,638", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,648", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,648", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,648", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,658", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,658", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,668", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,668", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,668", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,668", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,678", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,678", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,678", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,678", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,678", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,678", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,688", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,688", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,688", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,688", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,688", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,708", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,708", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,708", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,708", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,718", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,718", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,728", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,728", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,738", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,738", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,748", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,758", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,758", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,758", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,768", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,778", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,778", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,778", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,778", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,788", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,788", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,798", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,808", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,808", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,818", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,828", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,838", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,838", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,838", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,838", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,848", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,848", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,858", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,858", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,868", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,868", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,878", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,878", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,888", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,888", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,898", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,898", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,898", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,898", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,898", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,898", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,908", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,908", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,918", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,918", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,928", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,928", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,938", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,938", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,948", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,958", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,958", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,968", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,968", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,978", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,978", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,988", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,988", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:06,998", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:06,998", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,008", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,008", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,008", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,008", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,008", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,008", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,019", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,019", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,029", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,029", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,029", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,029", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,029", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,029", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,029", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,039", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,049", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,049", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,059", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,059", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,059", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,059", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,059", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,059", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,069", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,069", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,079", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,079", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,089", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,089", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,099", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,099", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,099", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,099", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,099", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,099", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,099", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,109", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,109", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,119", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,119", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,119", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,119", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,119", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,129", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,129", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,139", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,139", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,149", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,149", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,159", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,159", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,179", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,179", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,179", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,179", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,179", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,179", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,179", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,189", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,189", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,199", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,199", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,209", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,209", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,209", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,209", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,209", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,219", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,219", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,229", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,229", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,239", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,239", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,239", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,239", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,249", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,249", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,249", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,249", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,249", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,249", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,249", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,259", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,259", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,259", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,259", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,259", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,259", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,269", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,269", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,279", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,279", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,279", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,279", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,289", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,289", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,289", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,289", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,289", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,289", "api": "MoveFileWithProgressW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,299", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,299", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,309", "api": "NtReadFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,309", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,309", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,309", "api": "NtSetInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,309", "api": "NtFreeVirtualMemory"}, {"category": "network", "timestamp": "2016-02-16 17:42:07,319", "api": "InternetConnectA"}, {"category": "network", "timestamp": "2016-02-16 17:42:07,319", "api": "HttpOpenRequestA"}, {"category": "network", "timestamp": "2016-02-16 17:42:07,649", "api": "HttpSendRequestA"}, {"category": "network", "timestamp": "2016-02-16 17:42:07,649", "api": "InternetReadFile"}, {"category": "network", "timestamp": "2016-02-16 17:42:07,649", "api": "InternetCloseHandle"}, {"category": "network", "timestamp": "2016-02-16 17:42:07,649", "api": "InternetCloseHandle"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,649", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,659", "api": "NtFreeVirtualMemory"}, {"category": "threading", "timestamp": "2016-02-16 17:42:07,659", "api": "ExitThread"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegDeleteValueA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,659", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,659", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,659", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,659", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,659", "api": "FindFirstFileExW"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,669", "api": "NtFreeVirtualMemory"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,669", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,689", "api": "NtWriteFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,699", "api": "NtFreeVirtualMemory"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,699", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,699", "api": "RegSetValueExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,699", "api": "RegSetValueExA"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,699", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,699", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,699", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,699", "api": "NtQueryInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,699", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,790", "api": "ShellExecuteExW"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,870", "api": "ShellExecuteExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,870", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,870", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,870", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,870", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,870", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,870", "api": "MoveFileWithProgressW"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,940", "api": "CreateProcessInternalW"}]}, {"parent_id": 1592, "process_name": "vssadmin.exe", "process_id": 1840, "first_seen": "2016-02-16 17:41:36,314", "calls": [{"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "NtQueryValueKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,314", "api": "NtQueryValueKey"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,314", "api": "LdrGetDllHandle"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:41:36,324", "api": "DeviceIoControl"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "LdrGetDllHandle"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,324", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,324", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,324", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "LdrLoadDll"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,324", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,324", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:41:36,324", "api": "NtQueryValueKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtWriteFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:41:36,324", "api": "NtReadFile"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "WriteConsoleW"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "WriteConsoleW"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "WriteConsoleW"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "WriteConsoleW"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "WriteConsoleW"}, {"category": "system", "timestamp": "2016-02-16 17:41:36,324", "api": "LdrGetDllHandle"}, {"category": "process", "timestamp": "2016-02-16 17:41:36,324", "api": "ExitProcess"}]}, {"parent_id": 1592, "process_name": "NOTEPAD.EXE", "process_id": 592, "first_seen": "2016-02-16 17:42:07,850", "calls": [{"category": "misc", "timestamp": "2016-02-16 17:42:07,900", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,900", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:07,900", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,910", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,920", "api": "LdrLoadDll"}, {"category": "synchronization", "timestamp": "2016-02-16 17:42:07,920", "api": "NtCreateMutant"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,920", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,920", "api": "ZwMapViewOfSection"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "SetWindowsHookExA"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "SetWindowsHookExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,990", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,990", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,990", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:07,990", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "LdrGetDllHandle"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,990", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,990", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,990", "api": "ZwMapViewOfSection"}, {"category": "system", "timestamp": "2016-02-16 17:42:07,990", "api": "LdrGetDllHandle"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,000", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,000", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,000", "api": "ZwMapViewOfSection"}, {"category": "synchronization", "timestamp": "2016-02-16 17:42:08,000", "api": "NtOpenMutant"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,000", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,000", "api": "ZwMapViewOfSection"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "NtOpenKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,000", "api": "NtOpenKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,000", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,000", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,000", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,000", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,000", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,000", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,010", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,010", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,010", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,010", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,010", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,010", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,010", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,010", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,020", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,020", "api": "LdrGetDllHandle"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,020", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,020", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,020", "api": "GetSystemMetrics"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,020", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,020", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,020", "api": "NtQueryInformationFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,020", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,030", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,030", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExA"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,030", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,030", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,030", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,030", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,030", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,030", "api": "LdrLoadDll"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,030", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,040", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,040", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,040", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,040", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,050", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,050", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,050", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,060", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,060", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,060", "api": "RegCloseKey"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,060", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,060", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,060", "api": "LdrGetProcedureAddress"}, {"category": "windows", "timestamp": "2016-02-16 17:42:08,070", "api": "FindWindowA"}]}, {"parent_id": 1592, "process_name": "rundll32.exe", "process_id": 308, "first_seen": "2016-02-16 17:42:07,930", "calls": [{"category": "filesystem", "timestamp": "2016-02-16 17:42:07,940", "api": "NtOpenFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,940", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:07,940", "api": "ZwMapViewOfSection"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,980", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:07,980", "api": "NtOpenFile"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "IsDebuggerPresent"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,070", "api": "LdrLoadDll"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,070", "api": "GetSystemMetrics"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,070", "api": "ZwMapViewOfSection"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,080", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrLoadDll"}, {"category": "synchronization", "timestamp": "2016-02-16 17:42:08,080", "api": "NtCreateMutant"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "ZwMapViewOfSection"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "SetWindowsHookExA"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "SetWindowsHookExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,080", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,080", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,080", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,080", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrGetDllHandle"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,080", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "ZwMapViewOfSection"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,080", "api": "LdrGetDllHandle"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,080", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "ZwMapViewOfSection"}, {"category": "synchronization", "timestamp": "2016-02-16 17:42:08,080", "api": "NtOpenMutant"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "NtOpenSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,080", "api": "ZwMapViewOfSection"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "NtOpenKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,090", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,090", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,100", "api": "NtOpenKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,100", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetDllHandle"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,100", "api": "DeviceIoControl"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,100", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,100", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExA"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrLoadDll"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,110", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LookupPrivilegeValueW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,110", "api": "LookupPrivilegeValueW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtOpenFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtOpenFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "NtCreateFile"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "device", "timestamp": "2016-02-16 17:42:08,120", "api": "DeviceIoControl"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegSetValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "FindFirstFileExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,120", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,120", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,120", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,120", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,120", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,130", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,130", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,130", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "threading", "timestamp": "2016-02-16 17:42:08,130", "api": "CreateThread"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "SetWindowsHookExA"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "SetWindowsHookExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,130", "api": "GetSystemMetrics"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,130", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExA"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExA"}, {"category": "windows", "timestamp": "2016-02-16 17:42:08,130", "api": "FindWindowW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,130", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,130", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,130", "api": "NtSetInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,130", "api": "NtReadFile"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,130", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,140", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,140", "api": "LdrGetProcedureAddress"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,140", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,140", "api": "RegOpenKeyExW"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,150", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetDllHandle"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,150", "api": "GetSystemMetrics"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetDllHandle"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,150", "api": "NtCreateFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,150", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,150", "api": "ZwMapViewOfSection"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,150", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,150", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,150", "api": "NtQueryDirectoryFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,150", "api": "NtQueryDirectoryFile"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,150", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,150", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,160", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,160", "api": "ZwMapViewOfSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,160", "api": "ZwMapViewOfSection"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "misc", "timestamp": "2016-02-16 17:42:08,160", "api": "GetSystemMetrics"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegEnumKeyW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCreateKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,160", "api": "RegCloseKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrLoadDll"}, {"category": "threading", "timestamp": "2016-02-16 17:42:08,170", "api": "CreateRemoteThread"}, {"category": "threading", "timestamp": "2016-02-16 17:42:08,170", "api": "NtResumeThread"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,170", "api": "NtDelayExecution"}, {"category": "threading", "timestamp": "2016-02-16 17:42:08,170", "api": "CreateRemoteThread"}, {"category": "threading", "timestamp": "2016-02-16 17:42:08,170", "api": "NtResumeThread"}, {"category": "windows", "timestamp": "2016-02-16 17:42:08,170", "api": "FindWindowA"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,180", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,180", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,180", "api": "NtCreateFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,180", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,180", "api": "NtReadFile"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,210", "api": "NtCreateSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,210", "api": "ZwMapViewOfSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,220", "api": "ZwMapViewOfSection"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,220", "api": "ZwMapViewOfSection"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,220", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,230", "api": "LdrGetProcedureAddress"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,240", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,250", "api": "NtFreeVirtualMemory"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,250", "api": "NtFreeVirtualMemory"}, {"category": "misc", "timestamp": "2016-02-16 17:42:11,345", "api": "GetSystemMetrics"}, {"category": "threading", "timestamp": "2016-02-16 17:42:48,258", "api": "ExitThread"}, {"category": "registry", "timestamp": "2016-02-16 17:43:05,753", "api": "RegOpenKeyExW"}, {"category": "registry", "timestamp": "2016-02-16 17:43:05,753", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:43:05,753", "api": "RegCloseKey"}]}, {"parent_id": 1592, "process_name": "cmd.exe", "process_id": 296, "first_seen": "2016-02-16 17:42:07,970", "calls": [{"category": "system", "timestamp": "2016-02-16 17:42:08,130", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,160", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,250", "api": "LdrLoadDll"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,250", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,250", "api": "RegOpenKeyExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,250", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,250", "api": "RegOpenKeyExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,250", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegCloseKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegOpenKeyExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,260", "api": "LdrGetProcedureAddress"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegQueryValueExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "RegCloseKey"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,260", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,260", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,260", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,260", "api": "FindFirstFileExW"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,260", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,270", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,270", "api": "NtOpenKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,270", "api": "NtQueryValueKey"}, {"category": "registry", "timestamp": "2016-02-16 17:42:08,270", "api": "NtQueryValueKey"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,270", "api": "LdrGetDllHandle"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,270", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,270", "api": "LdrGetProcedureAddress"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,270", "api": "LdrGetProcedureAddress"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,270", "api": "NtOpenFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,270", "api": "NtQueryInformationFile"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,270", "api": "FindFirstFileExW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,310", "api": "DeleteFileW"}, {"category": "filesystem", "timestamp": "2016-02-16 17:42:08,310", "api": "NtQueryDirectoryFile"}, {"category": "system", "timestamp": "2016-02-16 17:42:08,310", "api": "LdrGetDllHandle"}, {"category": "process", "timestamp": "2016-02-16 17:42:08,310", "api": "ExitProcess"}]}];
|